Notice of Privacy Practices

Grana Medical, P.A. and Affiliated Professional Practices | www.quel.health

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who We Are

This notice covers Grana Medical, P.A., Grana Medical East, P.C., Grana Medical West, P.C., Grana Medical Midwest, P.A., and Grana Medical Northwest, P.C., each for its own patients, and covers their clinicians and workforce ("we" or "the Medical Group"), the independent medical practices that provide your care through the Quel platform. Quel Health, Inc. provides technology and administrative services to the Medical Group as its business associate under written agreements that require it to protect your information.

Our Promise, and the Extra Protection Your Records Carry

We are required by law to maintain the privacy and security of your protected health information, to give you this notice of our legal duties and privacy practices, and to follow the notice currently in effect. Because we provide substance use disorder care, we go further: we have adopted the federal confidentiality standard for substance use disorder records, 42 U.S.C. 290dd-2 and 42 CFR Part 2 ("Part 2"), as our own policy for every patient record. Part 2 does not apply to our practice by law, because we receive no federal assistance of any kind. Our adoption of it is a commitment about how we protect your records, and we hold ourselves accountable to it.

What Part 2 means for you, in plain language

We will not use or disclose your records except as this notice and your signed consent permit. If anyone seeks your records for use in a civil, criminal, administrative, or legislative proceeding against you, we will never consent on your behalf, we will notify you where the law allows, we will object and assert every protection available to us and to you, and we will disclose only what a court finally orders after we have exhausted reasonable objections.

Uses and Disclosures That Require Your Written Consent

Treatment, payment, and health care operations

Under Part 2, even routine uses of your records for treatment, payment, and health care operations require your written consent. During intake we ask you to sign a single consent that covers these uses, so your care, billing, and our operations can run smoothly. That consent explains exactly what may be shared and with whom, does not expire until you revoke it, and may be revoked in writing at any time, with effect going forward. Information disclosed under it to recipients covered by HIPAA may be redisclosed by them as HIPAA permits, but never for use in proceedings against you. You may request a copy of your signed consent at any time.

Uses that always require a separate, specific consent

Disclosures of your records to family members, friends, or anyone else you designate.
Counseling session notes, where applicable, beyond what the law permits.
Marketing. We do not use your information for marketing, and we would never do so without your separate written consent.
Sale of your information: never. We do not sell patient information, and no consent for sale will ever be sought.

Uses and Disclosures Permitted Without Your Consent

Federal law permits us to use or disclose your records without your written consent only in limited circumstances:

Within the Medical Group, among clinicians and staff who need the information in connection with their duties, and with entities under common administrative control.
To qualified service organizations and business associates, such as our technology, electronic health record, and payment vendors, under written agreements that bind them to these confidentiality protections.
In a bona fide medical emergency, to medical personnel who need the information to treat you, with documentation in your record.
To auditors, accreditation bodies, and government agencies conducting audits or evaluations, which may not redisclose your identifying information except back to us or as the regulations allow.
Pursuant to a court order, after we have asserted available objections; we will not produce records in response to a subpoena alone without notifying you where the law allows and giving you the opportunity to object.
To report a crime committed on our premises or against our personnel, limited to the circumstances of the incident.
To report suspected child abuse or neglect as state law requires; this permits the initial report only, and your records otherwise keep their protection.
To report cause of death as required by law.
For research, audits, or public health purposes under conditions the regulations strictly define, or as de-identified information that cannot reasonably identify you.
To the Food and Drug Administration regarding the safety of a drug or medical device.
Any use or disclosure of your information not described in this notice will be made only with your written authorization, and you may revoke that authorization in writing at any time, with effect going forward.

Technology and Artificial Intelligence

Our care team uses technology tools, including artificial intelligence tools, to support scheduling, documentation, and care operations. These tools assist people and do not replace clinical judgment: any output that influences a decision about your care or access to treatment is reviewed by a human. Vendors whose tools process your information are bound by the written confidentiality agreements described above, and we de-identify information where possible.

Your Rights

Access and copies. You may inspect and receive a copy of your medical record, including an electronic copy, by contacting privacy@quel.health or through your patient portal. We will respond within the time required by law, and may charge a reasonable cost based fee for copies.
Confidential communications. You may ask us to contact you in a specific way or at a specific location, and we will honor all reasonable requests. We will not ask you why.
Amendment. If you believe information in your record is incorrect or incomplete, you may request an amendment in writing. We may decline in limited circumstances, and if we do, we will explain why and you may add a statement of disagreement to your record.
Accounting of disclosures. You may request a list of certain disclosures of your records, covering up to six years before your request as HIPAA provides. Consistent with the heightened standard we apply, we will also account for disclosures made with your written consent for up to three years before your request.
Restrictions. You may request restrictions on how we use or disclose your information. Because we are a cash pay practice and do not bill health plans, the right to restrict disclosures to a health plan for services you paid for out of pocket is honored automatically: no such disclosures occur.
Paper copy. You may request a paper copy of this notice at any time, even if you agreed to receive it electronically.
Breach notification. We will notify you as required by law if a breach occurs involving your unsecured information.

Changes to This Notice

We may change this notice, and changes apply to information we already hold as well as information we receive in the future. The current notice is always posted at quel.health and in the app, with its effective date, and material changes will be communicated to you.

Complaints and Questions

If you have questions about this notice or believe your privacy rights have been violated, contact our Privacy Officer, Grana Medical, P.A., 2810 N Church St Ste 88860, Wilmington, DE 198082, privacy@quel.health, 855-438-7835. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, through the OCR Complaint Portal at ocrportal.hhs.gov or at 1-800-368-1019, including for violations of the Part 2 confidentiality protections. We will never retaliate against you for filing a complaint, and your care will never be affected by it.